GitHub MCP Server advisory reports an unauthenticated denial of service in its completion handler

An advisory published July 20 for the GitHub MCP Server (GHSA-w4q6-qw23-4rg7, CVE-2026-47427) reports an unauthenticated denial of service in the server's completion handler. The CompletionsHandler function accessed params.Ref without a nil check, so a malformed completion/complete request missing required parameters caused a panic that terminated the server process.

The advisory record rates it High at CVSS 7.5 with an availability-only impact vector, reflecting that the flaw crashes the process but does not expose data. The affected module is github.com/github/github-mcp-server in the Go ecosystem below 1.1.0, with 1.1.0 as the patched version.

The GHSA record is the only public source; no accompanying GitHub blog post or changelog entry was published for it, so there is no vendor commentary beyond the advisory text itself.